{"id":"https://openalex.org/W4307021254","doi":"https://doi.org/10.1145/3517745.3561433","title":"Exploring the security and privacy risks of chatbots in messaging services","display_name":"Exploring the security and privacy risks of chatbots in messaging services","publication_year":2022,"publication_date":"2022-10-21","ids":{"openalex":"https://openalex.org/W4307021254","doi":"https://doi.org/10.1145/3517745.3561433"},"language":"en","primary_location":{"id":"doi:10.1145/3517745.3561433","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3517745.3561433","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 22nd ACM Internet Measurement Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://strathprints.strath.ac.uk/85489/1/Edu_etal_ACM_IMC_2022_Exploring_the_security_and_privacy_risks_of_chatbots.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5051459324","display_name":"Jide Edu","orcid":"https://orcid.org/0000-0003-1325-8740"},"institutions":[{"id":"https://openalex.org/I183935753","display_name":"King's College London","ror":"https://ror.org/0220mzb33","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I183935753"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Jide Edu","raw_affiliation_strings":["King's College London, London, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"King's College London, London, UK","institution_ids":["https://openalex.org/I183935753"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005235740","display_name":"Cliona Mulligan","orcid":null},"institutions":[{"id":"https://openalex.org/I183935753","display_name":"King's College London","ror":"https://ror.org/0220mzb33","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I183935753"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Cliona Mulligan","raw_affiliation_strings":["King's College London, London, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"King's College London, London, UK","institution_ids":["https://openalex.org/I183935753"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072597369","display_name":"Fabio Pierazzi","orcid":"https://orcid.org/0000-0002-1254-1758"},"institutions":[{"id":"https://openalex.org/I183935753","display_name":"King's College London","ror":"https://ror.org/0220mzb33","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I183935753"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Fabio Pierazzi","raw_affiliation_strings":["King's College London, London, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"King's College London, London, UK","institution_ids":["https://openalex.org/I183935753"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018209439","display_name":"Jason Polakis","orcid":"https://orcid.org/0000-0001-5034-0730"},"institutions":[{"id":"https://openalex.org/I39422238","display_name":"University of Illinois Chicago","ror":"https://ror.org/02mpq6x41","country_code":"US","type":"education","lineage":["https://openalex.org/I39422238"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jason Polakis","raw_affiliation_strings":["University of Illinois at Chicago"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Chicago","institution_ids":["https://openalex.org/I39422238"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5004037873","display_name":"Guillermo Su\u00e1rez\u2010Tangil","orcid":"https://orcid.org/0000-0002-0455-2553"},"institutions":[{"id":"https://openalex.org/I2802499160","display_name":"IMDEA Networks","ror":"https://ror.org/04mm9fg30","country_code":"ES","type":"facility","lineage":["https://openalex.org/I105140100","https://openalex.org/I2802499160"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Guillermo Suarez-Tangil","raw_affiliation_strings":["IMDEA Networks Institute, Madrid, Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IMDEA Networks Institute, Madrid, Spain","institution_ids":["https://openalex.org/I2802499160"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052525506","display_name":"Jos\u00e9 M. Such","orcid":"https://orcid.org/0000-0002-6041-178X"},"institutions":[{"id":"https://openalex.org/I183935753","display_name":"King's College London","ror":"https://ror.org/0220mzb33","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I183935753"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Jose Such","raw_affiliation_strings":["King's College London, London, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"King's College London, London, UK","institution_ids":["https://openalex.org/I183935753"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":23,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"581","last_page":"588"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/permission","display_name":"Permission","score":0.916118323802948},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7104129195213318},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7077896595001221},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.7009965181350708},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6341283321380615},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6025762557983398},{"id":"https://openalex.org/keywords/variety","display_name":"Variety (cybernetics)","score":0.5146363973617554},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.46937039494514465},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.45277079939842224},{"id":"https://openalex.org/keywords/personally-identifiable-information","display_name":"Personally identifiable information","score":0.44946908950805664},{"id":"https://openalex.org/keywords/information-privacy","display_name":"Information privacy","score":0.42666661739349365},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.08715248107910156}],"concepts":[{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.916118323802948},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7104129195213318},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7077896595001221},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.7009965181350708},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6341283321380615},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6025762557983398},{"id":"https://openalex.org/C136197465","wikidata":"https://www.wikidata.org/wiki/Q1729295","display_name":"Variety (cybernetics)","level":2,"score":0.5146363973617554},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.46937039494514465},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.45277079939842224},{"id":"https://openalex.org/C169093310","wikidata":"https://www.wikidata.org/wiki/Q3702971","display_name":"Personally identifiable information","level":2,"score":0.44946908950805664},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.42666661739349365},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.08715248107910156},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3517745.3561433","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3517745.3561433","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 22nd ACM Internet Measurement Conference","raw_type":"proceedings-article"},{"id":"pmh:oai:strathprints.strath.ac.uk:85489","is_oa":true,"landing_page_url":"https://strathprints.strath.ac.uk/view/author/1497088.html>","pdf_url":"https://strathprints.strath.ac.uk/85489/1/Edu_etal_ACM_IMC_2022_Exploring_the_security_and_privacy_risks_of_chatbots.pdf","source":{"id":"https://openalex.org/S4306402226","display_name":"Strathprints: The University of Strathclyde institutional repository (University of Strathclyde)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I181647926","host_organization_name":"University of Strathclyde","host_organization_lineage":["https://openalex.org/I181647926"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Book Section"},{"id":"pmh:oai:eprints.ucl.ac.uk.OAI2:10201639","is_oa":false,"landing_page_url":"https://discovery.ucl.ac.uk/id/eprint/10201639/","pdf_url":null,"source":{"id":"https://openalex.org/S4306400024","display_name":"UCL Discovery (University College London)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I45129253","host_organization_name":"University College London","host_organization_lineage":["https://openalex.org/I45129253"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"In: Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC. (pp. pp. 581-588). Association for computering Machinery (ACM): Nice, Fance. (2022)","raw_type":"Proceedings paper"}],"best_oa_location":{"id":"pmh:oai:strathprints.strath.ac.uk:85489","is_oa":true,"landing_page_url":"https://strathprints.strath.ac.uk/view/author/1497088.html>","pdf_url":"https://strathprints.strath.ac.uk/85489/1/Edu_etal_ACM_IMC_2022_Exploring_the_security_and_privacy_risks_of_chatbots.pdf","source":{"id":"https://openalex.org/S4306402226","display_name":"Strathprints: The University of Strathclyde institutional repository (University of Strathclyde)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I181647926","host_organization_name":"University of Strathclyde","host_organization_lineage":["https://openalex.org/I181647926"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Book Section"},"sustainable_development_goals":[{"score":0.7699999809265137,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G1946144665","display_name":null,"funder_award_id":"EP/T026723/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G2132529326","display_name":"SAIS: Secure AI assistantS","funder_award_id":"EP/T026723/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G2980348971","display_name":"SaTC: CORE: Small: Black-Box Flaw Discovery in Web Authentication and Authorization Mechanisms","funder_award_id":"1934597","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3238974947","display_name":"CAREER: Tracking on the Modern Web: Novel Attacks, Measurements, and Defenses","funder_award_id":"2143363","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5646307217","display_name":null,"funder_award_id":"CNS-1934597, CNS-2211574, CNS-2143363","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6528883747","display_name":"Collaborative Research: SaTC: CORE: Medium: App-driven Web Browsing: Novel Risks, Vulnerabilities, and Defenses","funder_award_id":"2211574","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4307021254.pdf","grobid_xml":"https://content.openalex.org/works/W4307021254.grobid-xml"},"referenced_works_count":27,"referenced_works":["https://openalex.org/W154677184","https://openalex.org/W1517527854","https://openalex.org/W1975219037","https://openalex.org/W2025765878","https://openalex.org/W2059621117","https://openalex.org/W2061603028","https://openalex.org/W2067868328","https://openalex.org/W2073746123","https://openalex.org/W2090837542","https://openalex.org/W2238470380","https://openalex.org/W2510556079","https://openalex.org/W2550183133","https://openalex.org/W2568120622","https://openalex.org/W2735065902","https://openalex.org/W2748561986","https://openalex.org/W2771546055","https://openalex.org/W2923317037","https://openalex.org/W2963070937","https://openalex.org/W3032645997","https://openalex.org/W3035613258","https://openalex.org/W3048729354","https://openalex.org/W3082398667","https://openalex.org/W3085238546","https://openalex.org/W3094044550","https://openalex.org/W3096559598","https://openalex.org/W3216878703","https://openalex.org/W4224312274"],"related_works":["https://openalex.org/W2295836226","https://openalex.org/W4225340788","https://openalex.org/W2025792237","https://openalex.org/W2272742059","https://openalex.org/W3010786834","https://openalex.org/W2098937825","https://openalex.org/W3123738772","https://openalex.org/W1996189363","https://openalex.org/W3003650144","https://openalex.org/W2940702331"],"abstract_inverted_index":{"The":[0],"unprecedented":[1],"adoption":[2],"of":[3,29,129,143],"messaging":[4,49,81],"platforms":[5,106],"for":[6,16,73],"work":[7],"and":[8,44,70,77,140],"recreation":[9],"has":[10],"made":[11],"it":[12],"an":[13],"attractive":[14,30],"target":[15],"malicious":[17],"actors.":[18],"In":[19,60],"this":[20,61],"context,":[21],"third-party":[22,121],"apps":[23],"(so-called":[24],"chatbots)":[25],"offer":[26],"a":[27,65,132,149],"variety":[28],"functionalities":[31],"that":[32,67,94,98,127],"support":[33],"the":[34,41,57,90,96,137],"experience":[35],"in":[36,48,80],"large":[37],"channels.":[38],"Unfortunately,":[39],"under":[40],"current":[42],"permission":[43],"deployment":[45],"models,":[46],"chatbots":[47,99,130,144],"systems":[50],"could":[51],"steal":[52],"information":[53],"from":[54,89,131],"channels":[55],"without":[56],"victim's":[58],"awareness.":[59],"paper,":[62],"we":[63,125],"propose":[64],"methodology":[66],"incorporates":[68],"static":[69],"dynamic":[71],"analysis":[72],"automatically":[74],"assessing":[75],"security":[76],"privacy":[78,150],"issues":[79],"platform":[82,93],"chatbots.":[83],"We":[84],"also":[85],"provide":[86,148],"preliminary":[87],"findings":[88],"popular":[91,105],"Discord":[92,112,134],"highlight":[95],"risks":[97],"pose":[100],"to":[101,120],"users.":[102],"Unlike":[103],"other":[104],"like":[107],"Slack":[108],"or":[109],"MS":[110],"Teams,":[111],"does":[113],"not":[114],"implement":[115],"user-permission":[116],"checks---a":[117],"task":[118],"entrusted":[119],"developers.":[122],"Among":[123],"others,":[124],"find":[126],"55%":[128],"leading":[133],"repository":[135],"request":[136],"\"administrator\"":[138],"permission,":[139],"only":[141],"4.35%":[142],"with":[145],"permissions":[146],"actually":[147],"policy.":[151]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":3}],"updated_date":"2026-07-26T07:53:14.480251","created_date":"2025-10-10T00:00:00"}